Yeah, the all_urls add-ons are always concerning. We have an issue filed to move that to optional_permissions instead, but need to get the UX right:
https://github.com/mozilla/fx-private-relay/issues/252